Domain Name System Security Extensions (DNSSEC) is a set of security extensions to DNS that provides a way for authenticating DNS records. DNSSEC is defined by the IETF in RFCs 4033, 4034, and 4035. Each answer from a DNS SEC protected zone is digitally signed. DNSSEC provides a way for DNS records to be trusted by whoever receives them. DNSSEC uses public key cryptography to ensure that DNS records are authentic. DNSSEC not only allows a DNS server to prove the authenticity of the records it returns, it also allows the assertion of “non-existence of records”. The DNSSEC trust chain is a sequence of records that identify either a public key or a signature of a set of resource records. The root of this chain of trust is the root key which is maintained and managed by the operators of the DNS root.
Several record types are defined by DNSSEC including DNS public key (DNSKEY), delegation signer (DS), and resource record digital signature (RRSIG). The DNSKEY record type is a public key used to sign a set of resource records (RRset). The DS record type is a delegation signer (a hash of a key). The RRSIG record type is a signature of a RRset that shares name/type/class. The DNSKEY can be classified into two roles, which can be handled by separate keys or a single key. For example, a key signing key (KSK) can be used to sign DNS KEY records. A zone signing key (ZSK) can be used to sign all other records in the domain in which it is authoritative for.
The set of all records of a given type for a domain name is called an RRset. An RRSIG (Resource Record SIGnature) is essentially a digital signature for an RRset. Each RRSIG is associated with a DNSKEY. The RRset of DNSKEYs are signed with the key signing key (KSK). All others are signed with the zone signing key (ZSK). Trust is conferred from the DNSKEY to the record though the RRSIG: if you trust a DNSKEY, then you can trust the records that are correctly signed by that key.
However, the domain's KSK is signed by itself, making it difficult to trust. The way around this is to walk the domain up to the next/parent zone. To verify that the DNSKEY for example.com is valid, you have to ask the .com authoritative server. This is where the DS record comes into play: it acts as a bridge of trust to the parent level of the DNS.
The DS record is a hash of a DNSKEY. The .com zone stores this record for each zone that has supplied DNSSEC keying information. The DS record is part of an RRset in the zone for .com and therefore has an associated RRSIG. This time, the RRset is signed by the .com ZSK. The .com DNSKEY RRset is signed by the .com KSK.
The ultimate root of trust is the KSK DNSKEY for the DNS root. This key is universally known and published. By following the chain of DNSKEY, DS and RRSIG records to the root, any record can be trusted.